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Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings of claims in the application: 
Listing of Claims: 

1.-8. (Canceled) 

1 9. (Currently amended) A computer-implemented method for ensuring non- 

2 repudiation of a payment request, the payment request being generated in a computing 

3 environment having a connection to a network, the method comprising the steps of: 

4 receiving, over the network, the payment request together with a certificate 

5 identifying a user having caused the payment request to be generated, the certificate including 

6 certificate-identifying information and user-identifying information, the certificate further 

7 including authority information defining an authority of the user to make the payment request 

8 the authority information including a maximum payment that the user is authorized to make and 

9 an identification of payees to whom the user is authorized to make payments ; 



10 validating the certificate-identifying information and the user-identifying 

1 1 information included within the received certificate; 

12 accessing a store of authority information that is coupled to the network, that is 

1 3 stored apart from the payment request and that is independent of the received certificate; 

14 retrieving, from the accessed store of authority information, stored authority 

1 5 information that is associated with the user; 

16 comparing the retrieved authority information with the authority information 

17 included within the received certificate to determine whether the retrieved authority information 

1 8 matches the authority information included within the received certificate; 

19 validating the authority information within the received certificate only if the 

20 retrieved authority information matches the authority information included within the received 

21 certificate, and 
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22 executing of the payment request only when the certificate-identifying 

23 information, the user-identifying information and the authority information within the received 

24 certificate is successfully validated. 

1 10. (Original) The method of claim 9, wherein the payment request is for a 

2 predetermined amount and wherein the payment request is authorized only when the validating 

3 steps are successful and when the authority information for the user stored in the hierarchical 

4 authority data structure lists an authorized amount for the user at least equal to the predetermined 

5 amount. 

1 11. (Original) The method of claim 9, wherein the certificate received in the 

2 receiving step conforms to the X.509 standard. 

1 12. (Original) The method of claim 9, wherein the authority information is 

2 configured as XML code. 

1 13. (Original) The method of claim 9, wherein the XML code is compliant 

2 with a DSML standard. 

14. (Canceled) 

1 15. (Currently amended) A computer-readable storage medium configured to 

2 store one or more software application configured to carry out a financial transaction, the 

3 application being configured to run on a computer coupled to a network, and comprising, stored 

4 en-a the computer-readable storage medium comprising : 

5 certificate receiving code which is configured to receive a digital certificate from 

6 a user over the network, the certificate including certificate-identifying information and user- 

7 identifying information, the certificate further including authority information that defines an 

8 authority granted to the user to request that the financial transaction be carried out , the authority 

9 information including a maximum payment that the user is authorized to make and an 
10 identification of payees to whom the user is authorized to make payments ; 
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1 1 certificate validating code configured to enable validation of the certificate- 

12 identifying information and user-identifying information within the received certificate, and 

13 authorization validating code configured to cause the computer to carry out steps 

14 of: 

15 accessing a store of authority information that is coupled to the network, 

16 that is stored apart from the payment request and that is independent of the received certificate; 

17 retrieving, from the accessed data structure, stored authority information 

1 8 that is associated with the user; 

19 comparing the retrieved authority information with the authority 

20 information included within the received certificate to determine whether the retrieved authority 

21 information matches the authority information included within the received certificate; 

22 validating the authority information within the received certificate only if 

23 the retrieved authority information matches the authority information included within the 

24 received certificate, and 

25 executing of the financial transaction only when the authority information 

26 within the received certificate is successfully validated. 

1 16. (Currently amended) The computer-readable storage medium software 

2 application of claim 15, wherein the digital certificate conforms to the X.509 standard. 

1 17. (Currently amended) The computer-readable storage medium software 

2 application of claim 15, wherein the authority information is configured as XML code. 

1 18. (Currently amended) The computer-readable storage medium software 

2 application of claim 17, wherein the XML code is compliant with a DSML standard. 

1 19. (Currently amended) The computer-readable storage medium software 

2 application of claim 15, wherein the authority defined by the authority information within the 

3 received certificate also defines rights of the user to access predetermined data and programs 

4 within the network. 
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20.-28. (Canceled) 

1 29. (Currently amended) In a computing environment having a connection to 

2 a network, computer readable code readable by a computer system in said environment, for 

3 enabling a A server computer within the computing environment to both authenticate a user of a 

4 client computer within the computing environment and to verify that the user is authorized to 

5 request that the server computer carry out a requested action, the server computer comprising: 

6 a processor; and 

7 a memory coupled to the processor and configured to store a set of instructions 

8 that when executed by the processor causes the processor to: 

9 receive a payment request along with a digital certificate assigned to the 

10 user of the client computer, the digital certificate comprising a first code portion and a second 

1 1 code portion, 

12 wherein the first code portion of the digital certificate is configured 

13 to enable authentication of the user, the first code portion defines a public key, a certificate serial 

14 number, a certificate validity period, a digital signature of the certificate authority, and an 

15 extension field, 

16 wherein the second code portion of the digital certificate is 



17 configured to define an authority of the user of the client computer to request that the server 

1 8 computer carry out the requested action, the second code portion being configured for inclusion 

19 within the extension field of the first code portion, the authority of the user defined within the 

20 second code portion of the certificate defining access rights of the user including a maximum 

21 payment that the user is authorized to make and an identification of payees to whom the user is 

22 authorized to make payments to data and programs within the computing environment ;!"!",]] and 

23 code for causing the server computer to carry out steps of: 

24 access[[ing]] a store of authority information that is coupled to the 

25 network that is stored apart from the payment request and that is independent of the received 

26 digital certificate; 
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27 retrieve[[ing]], from the accessed store of authority information, authority 

28 information that is associated with the user of the client computer; 

29 compare[[ing]] the retrieved authority information with the authority 

30 information included within the digital certificate to determine whether the retrieved authority 

3 1 information matches the authority information included within the digital certificate; 

32 validate[[ing]] the authority information within the digital certificate only 

33 if the retrieved authority information matches the authority information included within the 

34 digital certificate, and 

35 carry[[ing]] out the requested action only when the authority information 

36 within the digital certificate is successfully validated. 

1 30. (Currently amended) The server computer readable code of claim 29, 

2 wherein the digital certificate conforms to the X.509 standard. 

1 31. (Currently amended) The server computer readable code of claim 2.9, 

2 wherein the second code portion is configured as XML code. 

1 32. (Currently amended) The server computer readable code of claim 3 1 , 

2 wherein the XML code is compliant with a DSML standard. 

1 33. (Currently amended) The server computer readable code of claim 29, 

2 wherein the authority of the user of the client computer is stored in a hierarchical authority data 

3 structure that is accessible by the server computer. 
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